Re: Setup "locked down" RPG CGI environments on IBM i

Adoptive authority happens when you CHGPGM USRPRF(*OWNER) and change the ownership to some profile with the authority you need. I don't think it works with IFS files, but it does with commands.

Then you'd create the STRHTTPSVR command and make it *PUBLIC *EXCLUDE - then make its owner the same as its command-processing program. That program would also be *PUBLIC *EXCLUDE.

Give your developer *USE to the command.

GRTOBJAUT is the command you mainly need.

I think!

Vern

Aaron Bartell wrote:

Yep, that is what I need. Does anybody have sample code showing how to do
this to give me a head start? Specifically adoptive authority is the one
area I am a noob at.

Aaron Bartell
http://mowyourlawn.com
http://mowyourlawn.com/blog/


On Thu, Apr 8, 2010 at 2:32 PM, Vern Hamberg <vhamberg@xxxxxxxxxxx> wrote:

Aaron

If you want to restrict a user to starting only a certain Apache
instance, maybe block out STRTCPSVR and ENDTCPSVR and create equivalent
commands defaulting to running those commands with the instance pre-set.
These would need to have adopted authority to run the *TCPSVR commands.
These users could also be restricted to just their resources - timeshare
boxes do something like this, I imagine - I know the one I'm one does
not let me see other developers' stuff.

And the Apache config gives you limits according to the various
directives for directories, right?

Is that anywhere close to addressing your question? If so or not - back
to work!! :-)

Vern

Aaron Bartell wrote:

I am hoping this is the right forum to ask this in because it mostly has

to

do with system setup.

This post is concerning a new thread I started on the YiPs forum this
morning which can be viewed at the following location:

http://174.79.32.155/forum/viewtopic.php?f=7&t=182&sid=0482f50a14bf2305053373ee2cdb5c9d#p865

Basically I am in need of some insight on how best to setup locked down
environments for RPG CGI development. I need to give RPG developers

enough

access to accomplish a tutorial but not allow them to touch anybody elses
stuff (i.e. jobs, libraries, spool files, etc).

Has anybody setup such an environment and would you be willing to share

your

thoughts and ideas? and maybe even code that helped with things like
starting and stopping Apache servers in a locked down nature. For

example,

users could use ENDTCPSVR directly but they could call a custom command

like

the following: ENDHTTPSVR SVR(RPGUI001)

Aaron Bartell
http://mowyourlawn.com
http://mowyourlawn.com/blog/

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.